Why the Government's Ability to Protect Against Online Attacks Is Limited

The government's ability to change online behavior has limits. Congress passed legislation to limit spam, but it has done little to reduce the volume of junk mail clogging inboxes. "The wheels of government spin far more slowly than the wheels of technology, and by passing legislation quickly, government can hurt as much as they help," says Richard Wang, a security expert with SophosLabs.

Rather than address a particular vulnerability, some say, the government should try to create partnerships to deal with new threats. "If the government has any clever ideas to solve its cybersecurity problems, certainly a lot of us could benefit from those solutions. If it has an idea for improving network security, it should tell everyone," Bruce Schneier, a veteran cryptographer, wrote recently on his influential security blog.

The Pentagon will soon create its own Cyber Command to coordinate both offensive and defensive efforts online, according to reports in the Wall Street Journal. That announcement comes on the heels of a revelation that hackers—likely based in China—stole large amounts of engineering data about the $300 billion Joint Strike Fighter project. Defense Department personnel meanwhile, were recently banned from using portable flash drives on military computer networks during the outbreak of a particularly difficult to detect computer worm. In total, the Pentagon spent more than $100 million in the past six months responding to various cyberattacks, officials revealed earlier this month. One such attack, also believed to be the work of Chinese hackers, infected nearly 75 percent of the computers at the largest military base in Afghanistan.

Meanwhile, the mysterious Conficker worm continues to challenge civilian security experts, who can't enforce drastic measures like banning flash drives. Instead, a public-information campaign warned users about the threat, and a group of experts formed a working group to provide free diagnostic advice. But the worm is still infecting computers worldwide and, in a particularly insidious twist, is tricking some infected machines into installing fraudulent antivirus software.

Experts say that large-scale information campaigns to encourage better computer hygiene could be one important step. The government could also use its purchasing power to pressure software makers to meet higher safety standards. That could help solve common problems for both government and private users. The cyberexperts draw an analogy to measures used to limit highway fatalities 50 years ago. The government can mandate car safety devices and enforce the laws of the road. But it's up to the individual drivers to ensure they have working brakes, drive safely, and buckle up.